CVE-2019-25253

KYOCERA Net Admin 3.4.0906 is affected by an XML External Entity (XXE) injection in the Multi-Set Template Editor. The vulnerability allows unauthenticated attackers to read arbitrary system files by crafting an XML with external entity references, potentially exposing sensitive data such as data...

CVE-2019-25254

KYOCERA Net Admin 3.4.0906 is affected by a cross-site request forgery (CSRF) that allows an attacker to create administrative users without proper request validation. Public sources (Red Hat, CVE lists, PT-Security) describe that malicious pages can automatically submit requests when a logged-in...